Closed-environment legal review package

LEGAL_PACKAGE_COMPLETE=YES · EXTERNAL_LEGAL_REVIEW=PENDING

AITS_LEGAL_PACKAGE_20261002_V9_1 · 2 October 2026 UTC

Registration CLOSED · LIVE DISABLED · ORDERS NO · AUTO_APPLY NO · EXTERNAL_EXECUTION HARD_DISABLED

This complete, owner-authorized English review package supplements the existing English/Czech draft notices. It is not activated customer terms, a licence or legal approval.

Status and operator

PMGI PROJECT MANAGEMENT SERVICES L.L.C (One Person LLC), Dubai, UAE; licensed spelling P M G I PROJECT MANAGEMENT SERVICES L.L.C; Commercial License 1471379; licensed address Office C1802-51, Business Bay, Dubai, UAE. Support, complaints and privacy: info@pmgi.ae, owner-confirmed monitored. Preparation is complete for final review; EXTERNAL_LEGAL_REVIEW=PENDING; owner-authorized technical publication does not assert professional approval. A commercial licence is not evidence of financial-services authorization. No regulated status, investor protection scheme, insurance, custody licence or regulatory endorsement is claimed.

Current operating perimeter

This release is a closed-registration environment: no real customer onboarding or client money; synthetic isolated PAPER accounts only. The owner account separately displays existing authorized read-only account observations. Simulation does not place exchange orders, accept money, hold customer assets or create redeemable balances. Public and private registration remain closed. Real orders, payments, withdrawals, live trading, AUTO_APPLY and external execution remain disabled. No future investment service is offered by these review documents.

Terms and demo conditions

Access is personal and limited to the authenticated tenant. Do not share credentials or recovery links, probe another account, scrape private information, or bypass controls. Simulation entries are explicitly user-entered practice instructions with pending/success/failed outcomes; simulated deposits and withdrawals never move money. New simulated accounts start at zero. Modeled fees are not charges. No subscription or real transaction fee is collected. There is no entitlement to redeem PAPER assets. Security restrictions may suspend access; a verified closure request can disable access and revoke sessions. Mandatory rights are not waived. Material changes must be versioned and re-reviewed before scope expansion.

Market, performance and risk disclosures

Public market observations and private account balances are separate sources. Prices carry source and observation time and can become stale or unavailable. No USD/USDT parity, execution price, liquidity, return, risk limit, guarantee or personal investment recommendation is implied. Historical returns require compatible opening and closing valuations and reconciled flows. Missing periods are UNKNOWN, not zero; no interpolation from current holdings. Explicitly verified observation windows remain usable only within their stated coverage. Simulation results omit real-world execution, counterparty, slippage and operational risks. Crypto prices can be volatile and reported prices do not guarantee tradability.

Custody, permissions and access

AITS does not receive, pool, safeguard or transfer customer assets in this environment. Owner exchange accounts stay with their existing providers; read access does not establish withdrawal permissions, custody protection, solvency or regulatory authorization. Existing credentials remain backend infrastructure and are excluded from customer context and reports. No seed phrase, exchange password, private key or customer deposit is requested. The client cannot access owner wallets, the owner vault, admin tools, internal research or another tenant. No authority is granted to trade on a user’s behalf.

Privacy and data inventory

Controller: PMGI, contact above. Necessary account fields are name, normalized email, generated immutable identifiers, language, verification/status and notice acceptance evidence. Authentication stores password hashes, hashed recovery/verification references and expiring session references; never plaintext passwords. PAPER records hold tenant-scoped simulation instructions, positions, marks and reports. Security records contain minimal event/time and rate-limit metadata. No marketing consent, identity document, biometrics or optional analytics is collected by the application. The owner read-only mapping is separate from future customer onboarding. Do not include financial records or credentials in a support message.

Proposed purposes and legal bases for counsel review

Account and simulation data: necessity to provide the requested demo service, subject to counsel confirming the applicable UAE and audience-specific basis and necessity of each name field. Authentication and security: access protection and abuse prevention, subject to the applicable lawful basis and proportionality assessment. Acceptance evidence: demonstrate the applicable service terms and notice version; counsel must confirm the lawful basis and retention. Support and privacy requests: handle the request and applicable obligations, with identity minimization. Marketing: not performed. No blanket processing consent is inferred from reading a notice. No automated decision with legal or similarly significant effects is made. These are proposed mappings, not asserted approved legal bases.

Retention proposal and actual current behavior

The following schedule is a concrete minimization proposal for final approval, NOT an activated purge or a representation that deletion already occurs. Unverified signup and unused invitation records: 7 days after expiry. Expired verification/reset token rows and expired sessions: 7 days after expiry, preserving only minimal linked security audit when justified. Active profile and simulated ledger: while active; close and revoke promptly on verified request; purge or irreversibly de-identify 30 days after verified closure unless a documented lawful hold applies. Security and access logs: rolling 90 days. Resolved support/privacy cases: 12 months after closure. Notice acceptance evidence: 12 months after closure, subject to counsel’s mandatory limitation-period assessment. Encrypted rolling operational backups: 30 days; restore must replay deletion tombstones before service resumes. Synthetic non-personal regression evidence: 12 months; sanitized source/release hashes: 24 months. Holds require a recorded basis, custodian, scope and 90-day review, never indefinite default retention. Actual current customer deletion intervals are not approved; automatic customer purge is not enabled. Link expiry (verification 24 hours, reset and authenticated session 30 minutes) is not row deletion.

Deletion and request handling procedure

Responsible operational role: PMGI service operator; accountable privacy/complaints role: PMGI management through info@pmgi.ae. Record a minimal case reference, received time, request type and due-date assessment. Verify control through the authenticated account or existing verified email; never ask for password, recovery token or unnecessary identity documents. Confirm scope and applicable legal deadline, search tenant-specific profile, ledger, consent, auth, audit, mail/log and backup references; produce an export or proposed deletion inventory for review. Disable access and revoke sessions/tokens on verified closure through existing authorized operations. Review legal holds, approve the exact inventory, execute only under separately approved policy, retain minimal completion/tombstone evidence and reconcile backups on restore. Prevent cross-tenant exports. Proposed service targets: acknowledge within 5 business days and assess/escalate within 10 business days; these internal proposed targets never override a shorter applicable statutory deadline. Counsel must confirm applicable deadlines and supervisory authority before onboarding.

Processors, locations and subprocessors

DigitalOcean: application/database hosting, observed fra1 Frankfurt deployment; public DPA and subprocessor register linked below. Cloudflare: HTTPS edge, DNS/tunnel delivery and associated security metadata; network processing can be distributed. Hostinger: verification/recovery transactional email via HTTPS API and PMGI support mailbox; actual mailbox routing, storage and retention must be confirmed from the account. Public provider registers are references, not proof every listed subprocessor is used. No AI provider receives customer context while the adapter is disconnected. Account-specific contracts, service-specific subprocessors, region settings, edge/mail logging retention, cross-border mechanisms and rights-assistance terms require operator account evidence and qualified review. No residency or transfer compliance assurance is made from a public DPA alone.

Cookies, communications and security

The application uses the necessary secure HttpOnly SameSite=Lax session cookie for authentication and CSRF. Current application code has no optional marketing/analytics scripts or cookies. Edge providers may set security cookies; service-specific settings and audience requirements need review. No real test email is sent by this mission. TLS, tenant authorization, hashed secrets and expiring sessions are controls, not a security guarantee. Verified operational update, 2026-10-02 UTC: the client application and database use an encrypted LUKS volume. The service refuses to start on the underlying unencrypted path; service restart and locked-volume recovery were tested. Recipient-encrypted off-server backups on the encrypted owner T9 were recovered in memory and checked for integrity. The recovery private key is separate from the server and backup destination. A Mac-side coordinator checks availability and schedules daily verified backups; Mac, network and destination availability remain operational dependencies. A full host reboot has not been tested. Older owner-only rollback copies remain access restricted; this update does not claim that all historical copies were retroactively encrypted. No external-client data has been onboarded. Client retention, deletion/restore reconciliation, provider-account details and onboarding qualification must be completed before registration opens. Security controls do not establish legal compliance or a service-availability guarantee.

Incident, complaints and continuity runbook

Report suspected account compromise or a service complaint to info@pmgi.ae without secrets. The operator records scope and time, preserves minimal access-controlled evidence, contains access using existing session revocation/account restriction, investigates affected tenant boundaries, and escalates to PMGI management and qualified counsel for any notification duties and deadlines. Never suppress required reporting or promise an unverified resolution date. Complaints are reviewed by management, with outcome and escalation options recorded; unresolved legal complaints require the competent jurisdiction/authority to be established by counsel. Rollback restores verified application code; do not overwrite newer runtime records with a stale database. Restore private data only under a specific recovery procedure with integrity and tenant checks. Protected off-device real-client recovery and named key custody remain prerequisites for opening.

MOZEK and independent qualification

MOZEK health is independently owned. The client consumes only an administrator-controlled qualification artifact bound to the client contract, exact Core build, test evidence hash, read-only tool scope, tenant/owner/research denial checks and freshness. Missing, UNKNOWN, stale, malformed, unavailable or failed evidence leaves it disconnected; no fallback to owner chat. Qualification does not open registration or enable execution. Text and Voice availability are not claimed while the transport is disconnected. Current independent qualification is PENDING.

Final-review decisions, not unfinished drafting

EXTERNAL_APPROVAL_REQUIRED: qualified counsel must approve the service/regulatory perimeter for Dubai/UAE and intended audience; applicable law, consumer rights and complaints authority; category-specific lawful bases, minimization and retention; processor/transfer terms and necessary-cookie treatment. PMGI must supply account-specific provider agreements/settings and approve accountable roles, the proposed schedule and separate key custody/off-device protection for future real clients. No licence or legal opinion is fabricated. Opening registration or real-money activity is outside this release and requires separate explicit authorization after the applicable controls and professional decisions. The closed environment remains subject to its current restrictions while review is pending.

Eligibility and restrictions

Registration is CLOSED to public and private applicants. Access is limited to the existing authorized owner and isolated synthetic test accounts. Possession of a URL or these documents grants no eligibility, invitation, contractual onboarding or authority to transact. No minor or third party may use another person’s credentials. Before any future audience is admitted, the operator must establish permitted locations, capacity/age requirements and any applicable restrictions with qualified advice. No worldwide availability, sanctions clearance or eligibility determination is represented.

Account and security responsibilities

Use a unique password and keep it confidential. Maintain control of the verified email address; never disclose passwords, recovery links, session cookies or API keys to support. Report suspected unauthorized access to info@pmgi.ae. Sign out on shared devices. Do not impersonate another person or bypass tenant controls. The operator protects access through existing controls; this wording does not transfer non-excludable legal duties to users. MFA is not currently available. No account security feature authorizes trading or money movement.

Liability and non-waivable rights

This free, restricted demonstration is supplied for observation and testing without a promise of uninterrupted availability, complete data, execution quality or investment outcomes. Do not rely on simulated balances, reports or unavailable history for a real financial decision. To the extent permitted by applicable law, no contractual warranty of fitness for investment or future profitability is offered. Nothing in these documents excludes liability that cannot lawfully be excluded, including any applicable mandatory consumer or data-protection rights; no blanket waiver, indemnity, binding arbitration or monetary liability cap is imposed. Legal review of applicable limitations remains pending.

Suspension and termination

The operator may suspend access where reasonably necessary to contain a security incident, suspected misuse or service failure, and may end this closed demonstration. Notice and explanation should be provided when safe and lawful, without compromising an investigation. A verified account holder may request closure at info@pmgi.ae; existing account-disable and session/token-revocation controls apply. Closure does not convert simulated assets into money and does not itself erase retained records. Data disposition follows the published actual behavior and separately approved retention process, subject to applicable rights and documented holds.

Governing law and jurisdiction fields

Verified operator location: Dubai, United Arab Emirates. Commercial Licence No. 1471379 identifies the commercial operator, not a financial regulator or a financial-services permission. Contractual governing-law selection: NOT ADOPTED in this closed review publication. Exclusive court, arbitration forum and competent privacy/consumer supervisory authority: NOT DESIGNATED without a supported jurisdictional assessment. Mandatory applicable law and non-waivable rights remain unaffected. Dubai location alone does not prove a chosen court, applicable customer law or financial regulatory authorization. The owner will arrange professional review after publication.

Publication, changes and acceptance

LEGAL_PACKAGE_COMPLETE=YES. EXTERNAL_LEGAL_REVIEW=PENDING. The owner authorized publication of this complete closed-environment package. Publication does not open registration, deem existing users to have accepted new contractual terms, approve future processing, or claim legal/regulatory review. Each document has a stable URL, version, publication date, content SHA-256 and change record. Existing recorded acceptances are not rewritten. Before any future onboarding, approved versions and content hashes must pass the existing registration controls. Prior V8 evidence remains in immutable checkpoints; V9 completes eligibility, liability, termination, law/jurisdiction fields, document indexing and all entry-point links.

Authoritative public references

Public sources do not prove account-specific contracts or service settings.

Terms · Privacy · PAPER disclosure · Account legal centre · Sign in